Runs in your browser. Your files and text never leave your device - nothing is uploaded.
4xx Client Error
What it means
The request lacks valid authentication credentials for the target resource.
| Property | Detail |
|---|---|
| Status class | 4xx Client Error |
| Defined in | RFC 9110, Section 15.5.2 |
| Cacheable by default | Only with explicit caching headers: a cache stores it when the response carries Cache-Control (max-age, s-maxage or public) or Expires. |
| Who needs to act | The client, which has to supply valid credentials. |
What does HTTP 401 Unauthorized mean?
HTTP 401 Unauthorized means the request did not include valid authentication credentials, so the server has not applied it. Despite the name, it is about authentication rather than permission: logging in or sending a fresh token can fix it. The server must include a WWW-Authenticate header describing how to authenticate.
How 401 Unauthorized works
RFC 9110 makes the WWW-Authenticate header mandatory on a 401. It carries at least one challenge naming a scheme the server accepts, such as Basic or Bearer, and when the challenge is Basic, browsers show their built-in username and password dialog. If the request already carried credentials, a 401 means they were refused, typically because a token expired, was revoked or was issued for a different audience. The name is a historical misnomer: the code for 'authenticated, but not allowed' is 403 Forbidden.
Example 401 request and response
GET /api/orders HTTP/1.1
Host: api.example.com
Authorization: Bearer expired-token-value
HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer realm="example", error="invalid_token", error_description="The access token expired"The error and error_description parameters come from the OAuth 2.0 Bearer Token specification (RFC 6750) and tell the client exactly why the token was refused.
What causes a 401 Unauthorized
- An expired or revoked access token or session cookie.
- A missing Authorization header, often stripped by a proxy or dropped when a request is redirected to another origin.
- A malformed header, such as a token sent without the 'Bearer ' prefix.
- An API key for the wrong environment, such as a test key used against production.
How to fix a 401 Unauthorized
If you are calling the API or site
- Log in again or refresh the access token, then retry once.
- Check that the Authorization header is present and correctly formatted on the request that actually reaches the server.
- Decode the token if it is a JWT and compare its exp, aud and iss claims with what the API expects.
If you run the server
- Always send WWW-Authenticate with a 401, as RFC 9110 requires.
- Return 403, not 401, when the user is authenticated but lacks permission.
- Make sure proxies and CDNs forward the Authorization header to the origin.
401 and SEO
Google treats 401, like every 4xx code except 429, as content that does not exist for indexing, so pages behind a login are simply not indexed. Its documentation also warns against using 401 or 403 to limit how fast Google crawls; those codes have no effect on crawl rate.
Related status codes
- 403 Forbidden: The credentials were understood but do not grant access; logging in again will not help.
- 407 Proxy Authentication Required: The same idea, but a proxy between the client and the server wants the credentials.
- 400 Bad Request: The request is malformed, whoever sent it.
Tools that help
- JWT Decoder shows the exp, aud and iss claims of a token.
- Base64 Decoder decodes the username:password inside a Basic auth header.
Frequently asked questions
The request lacks valid authentication credentials for the target resource.
A missing, expired, or invalid authentication token or API key.
Log in again or refresh your authentication token, and confirm it's included in the request (typically in the Authorization header).
A 401 means the server does not know who you are because credentials are missing or invalid, so authenticating may fix it. A 403 means the server refuses even though it knows who you are, or regardless of who you are, so new credentials usually will not help.
Sources
- RFC 9110, Section 15.5.2
- RFC 6750, Section 3 (Bearer token WWW-Authenticate)
- Google: How HTTP status codes affect Google's crawlers
Other 4xx Client Error codes
Reviewed by Raja Jahangir · Last reviewed: October 7, 2026